Why can't I do that?: Explaining Adaptive Security

Our world is increasingly being pervaded by connected digital devices that make up the Internet of Things, making it important to ensure that the security of these devices and the functionality they provide. We are working on techniques to support adaptive information security, where the security mechanisms used to protect these pervasive computing systems can change as the value of the assets being protected and the threats that arise in the environment change. A key challenge in any adaptive system is to ensure that users understand why the behaviour of the system is changing at runtime. This is particularly true of security adaptations because in many situations they are likely to prevent users from accessing functionality.

In recent work, we have focussed on software engineering techniques that support this through traceability for explaining adaptive security decisions. Our paper on this has been published by the European Alliance for Innovation in the journal, Transactions on Self-Adaptive Systems.

Comments

Post a Comment

Popular Posts

There is a proliferation of devices being developed to form the building blocks of the Internet of Things (IoT), from Internet-connected power sockets and light bulbs to kettles, toasters and washing machines. However, to realise the full potential of the IoT, it will be necessary to allow these devices to interconnect and share data with each other to deliver the functionalities required by end-users. In recent research on end-user programming for the IoT, my colleagues Pierre Akiki, Yijun Yu and myself have proposed the notion of Visual Simple Transformations (ViSiT), that provides a visual programming paradigm for users to wire together IoT devices. The video above shows a demonstration of the ViSiT solution and full details of the approach will appear in an upcoming special issue of the ACM Transactions on Computer-Human Interaction (ToCHI).

IOT-2016 7-9 September, 2016, Stuttgart, Germany from Charith Perera
Recent DDoS attacks on key internet services, like the attack that affected the Dyn domain name service, highlighted the security challenges associated with the proliferation of insecure Internet of Things (IoT) systems. This attack exploited common vulnerabilities like the use of default administration passwords on IoT devices such as internet-enabled CCTV cameras, internet-enabled appliances and smart home devices, to recruit over hundreds of thousands of nodes into a botnet. This capability highlights the cyber security threats associated with the IoT and brings into sharp relief the importance of considering both security and privacy when designing these systems.

In recent work, presented at the Internet of Things Conference, we describe a privacy-by-design framework for assessing the privacy capabilities of IoT applications and platforms. Building on more general design strategies for privacy in informaiton …

UPDATE: Exciting opportunities to join the team for this research project - we have vacancies for a Software Engineering post-doc: http://www.open.ac.uk/about/employment/vacancies/post-doctoral-research-associate-15086and a Research Software Engineer: http://www.open.ac.uk/about/employment/vacancies/research-software-engineer-15085
I am excited to learn that our bid to undertake a new EPSRC funded research project, "Citizen Forensics" has been successful. The project sits at the intersection of software engineering, psychology, policing and power/politics/economics, exploring the use of technology to improve collaboration between citizens and the police. I will be leading the project, which will involve my colleagues Blaine Price, Bashar Nuseibeh, Graham Pike (OU Psychology / Centre for Policing Research & Learning), Mark Levine (Psychology Exeter) and Peter Bloom (OU Faculty of Business & Law).

A key challenge of the project is to investigate how adaptive software…